How do I change what a role can do (the permission matrix)?

Open the Roles matrix from the security area. It shows roles as columns and permissions as rows, with a checkbox where a role has a permission. Tick or untick to grant or remove an ability for a role, then save. The change applies to everyone holding that role. Because this is powerful, every change to the role/permission matrix is automatically written to the audit log — who changed which permission on which role, and when. Be careful removing permissions from roles many people hold; it takes effect immediately. When in doubt, create a new narrow role rather than widening an existing one.